1. 1 CSCD496 Computer Forensics Lecture 13 Criminal Behavior Winter 2010

2. 2 Introduction First, privacy case – current http://www.privacylives.com/update-on-pennsylvania-school- accused-of-misusing-webcams-on-student-laptops/2010/02/23/ Next –Look at what motivates criminals to commit crimes –Example types of crimes using computers Cyberstalking Sex offenders Computer Intruders

3. 3 Crime and Technology In relating technology to crime, the question becomes –Are there new types of crime and criminals emerging because of technology? What do you think?

4. 4 Crime and Technology Not necessarily true –Technology and Internet adds new dimensions to crime –But … crime already exists Modus Operandi (MO)‏ –What does this mean? –Latin term that means method of operating –MO refers to how of committing a crime –Separate from motive as to why they commit crimes

5. 5 MO Criminal’s MO –Learned behaviors that can develop over time –Can be refined and improved as criminals become more experienced and confident –Can also become less competent and less skillful over time Criminal can have a deteriorating mental state Increase in mind-altering substances … perhaps

6. 6 Time and Skills May take years before someone becomes good at being a cyber criminal –Testimony by Kevin Mitnik describes himself as “self taught” http://www.fas.org/irp/congress/2000_hr/030200_mitnick.htm “I have 20 years experience circumventing information security measures, and can report that I have successfully compromised all systems that I targeted for unauthorized access save one. I have two years experience as a private investigator, and my responsibilities included locating people and their assets using social engineering techniques”

7. 7 Internet Crime Internet / Computers used for criminal activities –Victim selection, surveillance, contact, stalking and harassment –Theft of assets including bank accounts, intellectual property, resources –Destruction of assets including intellectual property, software and systems –Storing and dissemination of illicit materials

8. 8 Motive Motive - emotional, psychological or material need that impels and is satisfied by a behavior –Criminal motive is technology independent –Do you agree with this statement?

9. 9 Motive Turns out that... –Needs that are satisfied by a criminal’s pattern of behavior Separate from current technology!! Same motives have existed throughout history in one form or another

10. 10 Motive However –Existing motives can be aided or even enhanced by technology –Following groups of criminals use technology to help them commit crimes  Intruders  Sex Offenders – child porn, other  Cyber Stalking

11. 11 Intruders People break into computers for many reasons –Steal resources –Malicious destruction Grudge against an individual or company –Thrill Can it be done?

12. 12 Intruders A past profile of these offenders Male, between 12 and 28 Antisocial and without strong ties to people in real world Current knowledge about intruders (includes hackers) –Above characterization is too narrow This group can contain people of any age or gender Availability of tools has enabled almost anyone to become intruders

13. 13 Intruders Useful to consider nature and intent of crime –Computer intruders have been compared to arsonists Both destroy evidence to cover their tracks Often retaliate against some wrong or Wield their power –Was destruction intended to inflict damage or was it a cover up act

14. 14 Intruders Look at what was targeted in the attack –Narrow target – damage is focused and specific Have a grudge against a single individual Example: Wiped out /home/jane –Broad target – inflict damage on entire group or organization

15. 15 Intruders Example – Broad target Tim Lloyd, primary system administrator for Omega Engineering Corp. was fired for stealing expensive equipment In retaliation, Lloyd executed a time bomb on Omega’s main server that deleted the company’s important data and programs A high degree of skill was required to implement this targeted attack with the intent to destroy all of Omega’s important data and programs.... Also erased all related backup tapes Experts spent years recovering pieces of information from servers, desktops, and even computers

16. 16 Intruders Besides knowing or inferring intent –Can figure out who had access –In previous case, digital evidence implicated Lloyd He was the only one with access, motive and skill Skill Level can Provide Clues –Suspect uses widely available software and chooses weak targets – no obvious reason Likely low-skilled intruder Large pool of potential intruders, not easily identified

17. 17 Toolkits Automate Intrusion –Makes it hard to identify intruders –Suspects become indistinguishable from each other –If every crime scene is identical, more difficult to link suspect to a crime –Sometimes intruder will customize a widely used toolkit Add their own name to it or software

18. 18 Sex Offenders Sex offenders like the Internet – many reasons –Access to more victims –Access to victims all over the world –A lot of information exists about potential victims Online dating services, Social Engineering Sites Provide a lot of information – personals.yahoo.com Pictures, age, geographical region

19. 19 Sex Offenders Internet allows –Perpetrators to groom victims - gain their trust Grooming refers to ways that a sexual offender gains control over a victim Exploit their weaknesses to gain trust or instill fear –Loneliness, self esteem, sexual curiosity, inexperience –Takes advantage of vulnerabilities to develop a bond –Use controls to bond sexually, manipulate victims and discourage them from going to authorities

20. 20 Sex Offenders Internet allows anonymity –Can pretend to be a different sex, older or younger –More attractive –Example: 47 year old Ohio man posed as a 15 year old boy and convinced a 14 year old girl to send him sexually explicit photos and a videotape of herself performing sexual acts Relationship continued for 18 months, since the girl was 12 years old Man pled guilty to one charge of inducing a minor to produce child pornography

21. 21 Sex Offenders Common Sex offenses –Soliciting minors for sex –Making, possessing or distributing child pornography Finding Evidence –Want to link evidence to the offender –Might be straightforward or not

22. 22 Sex Offenders Example Yale geology professor, Anthony Lasaga admitted to possessing tens of thousands of images of children engaging in sexual acts Many of these images were downloaded from the Internet onto a computer in the geology department and then viewed on Lasaga’s computer A system administrator in geology department observed Lasaga accessing materials on server from his desktop and reported the incident to law enforcement. Was necessary to secure the entire geology building and network for related evidence

23. 23 Sex Offenders Motive –Vary with type of pornography Adult, child or other How it is gathered or created What is done with it once it is gathered –Altered, re-distributed –Motives don’t change because of the Internet Pictures of victims long before Internet

24. 24 Sex Offenders Motive –Not always easy to determine the motive –Debate role of porn in sexual offenses –Porn has been argued to be a cause of crime Example: Ted Bundy said he blamed porn for his behavior, Who Was Ted Bundy? He claims to have become obsessed with porn and viewing it broke down his resistance to commit violent crimes against women –Before executed in 1989, he admitted to murdering 40 young women in almost a dozen states during his four-year reign of terror '70s

25. 25 Stalking Stalking behavior is characterized as obsession with a victim –Stalkers who use the Internet often try to conceal identity –Obsession with victim usually reveals identity eventually –Attempts to discourage them can incite them to violence which places victims at risk

26. 26 Stalking In 1990, 5 women murdered in California by stalkers –Enacted a law to deal with stalking –In 1998, California included electronic communication in their anti-stalking law –California law has strongly influenced all of the anti-stalking laws in the US

27. 27 Stalking Definition of Stalking Any person who willfully, maliciously, and repeatedly follows or harasses another person and –Makes a credible threat with intent to place that person in reasonable fear of death or great bodily injury –Is guilty of the crime of stalking

28. 28 Stalking Definition of Stalking continued … Harass means a knowing and willful course of conduct directed at a specific person –That seriously alarms, annoys, torments, or terrorizes the person and that serves no legitimate purpose The course of conduct must be such –Would cause a reasonable person to suffer substantial emotional distress, and –Must actually cause substantial emotional distress to the person

29. 29 Cyber Stalking Persistence is one main concept when dealing with stalking –1 e-mail is not considered harassment –Not a pattern of behavior Cyber Stalking –Works the same as in the physical world –Telephone the victim, go to their house –Now use Internet or do a combination of physical and cyber stalking

30. 30 Cyber Stalking Example Cynthia Armistead Smathers of Atlanta became target during an e-mail discussion, June 1996 First she received nasty e-mails from account of Richard Hillyard of Norcross, GA Then she received messages sent through an anonymous re-mailer After Hillyard’s ISP cancelled his account, Cynthia began getting messages from the Centers for Disease Control and Prevention in Atlanta where Hillyard worked

31. 31 Cyber Stalking Example Then, she got 1000’s of e-mails from men who had said they had seen Cynthia’s posting of a nude woman, listing her e-mail and offering sex Police said there was little they could do until she got an anonymous message from someone who said he had followed her and her 5 year old daughter from their post office box to her home

32. 32 Cyber Stalking Victims –Studies indicate that many stalkers had a prior acquaintance with their victims before stalking behavior began –However its not clear whether cyber stalking which is newer agrees with these studies –Stalkers on Internet have the opportunity to search for victims ICQ, AOL profiles and lurk in IRC and AOL Chat rooms Look for targets – vulnerable individuals easy to intimidate

33. 33 Cyber Stalking Stalker Behavior –Suggested that stalkers will stop harassing their victims once they cease getting the desired response Not always the case Some stalkers become violent when they don’t get what they want Can lead to murder of victims – five women in California

34. 34 Conclusion Criminal Behavior –Criminals existed long before the Internet From the time there was organized societies –Internet and computers doesn’t affect the motivation to commit crimes Does make it easier to commit some crimes! –Cyber Stalking, Sex offenders and regular Criminals motivated by greed, power, revenge Usual motivations for “normal” crime drives cyber criminal behavior –Need to know how and why these groups operate Assists in investigations involving these types of crimes

35. 35 Resources Digital Evidence and Computer Crime by Eoghan Casey Elsevier Academic Press, 2004 National Center for Victims of Crime, Safety http://www.ncvc.org McGrath, M.G. and Casey, E. (2002) “Forensic psychiatry and the Internet: Practical perspectives on sexual predators and obsessional harassers in cyberspace”, Journal of American Academy of Psychiatry and Law, 30, 81-94

36. 36 End Next Assignment up